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RECOMMENDED ACTION 
1. REVIEW and APPROVE the Police Commission’s Audit of Anti-Terrorist Intelligence 
Section (Phase I). 


DISCUSSION 

One of the responsibilities of the liaison committee to the Anti-Terrorist Intelligence Section 
(ATIS), formerly known as Anti-Terrorist Division, is to ensure an audit is performed of ATIS. 
For quite some time, due to personnel resource constraints, the Police Commission has not been 
able to conduct a formal audit of ATIS, although there has been regular communication and 
updates. Because of the outstanding auditing skills at the Office of the Inspector General (OIG), 
I solicited the assistance of the Inspector General in this endeavor. Although the OIG has 
additional significant responsibilities as set forth in the Federal Consent Decree, the OIG was 
able to assist me in conducting and presenting the attached Audit. 


Due to the sensitive nature of investigations conducted by ATIS, I worked closely with the 
Inspector General, an Assistant Inspector General, and one Special Investigator in conducting 
this Audit. Because of the Audit’s broad scope, it was determined that it should be conducted in 
two phases. The Phase I portion of the Audit evaluated ATIS’ handling of all open and 
preliminary intelligence investigations that were investigated anytime between January 2005 and 
June 2006. The Audit also evaluated the associated confidential informant packages and search 
warrants, if any. Finally, the Audit evaluated ATIS’ handling of initial leads. I personally 
conducted interviews, reviewed investigative files and the OIG’s Audit methodology, received 
frequent briefings on preliminary findings, and discussed the findings presented in the Audit 
report. 
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The Audit contains information and suggestions, which I believe will improve ATIS’ operations. 
The OIG played a key role in developing the information and suggestions and this Audit is but 
one example of the OIG’s unique value and importance in providing oversight to the Department. 
The diligent work performed by the OIG is much appreciated and I look forward to their 
assistance in conducting the Phase II portion of the Audit. . 


I am submitting two versions of the Audit report: the attached public version and through 
separate correspondence, a confidential version. The attached report has been revised to omit 
confidential and sensitive information, and the report may be discussed in open session. 


The Inspector General and I are available to provide any additional information the Board may 
require. 


Respectfully, 
Alan J Hdr 
Commissioner 
Attachment 


c: Inspector General André Birotte, Jr. 
Executive Director Richard M. Tefank 
Chief of Police William J. Bratton 
Police Administrator Gerald L. Chaleff, Consent Decree Bureau 
Deputy Chief John M. Leap, Counter Terrorism and Intelligence Bureau 
Captain Gary S. Williams, Major Crimes Division 
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POLICE COMMISSION 
AUDIT OF ANTI-TERRORISM INTELLIGENCE SECTION (PHASE I) 
FISCAL YEAR 2006/2007 
PUBLIC VERSION 


PURPOSE 


Pursuant to the Los Angeles Police Department’s (LAPD or Department) Standards and 
Procedures for Anti-Terrorism Intelligence Section (ATIS), the Police Commission initiated a 
two-phased audit (Audit) of ATIS. The Phase I portion of the Audit evaluated ATIS’ handling 
of all open and preliminary intelligence investigations that were investigated anytime from 
January 2005 to June 2006. The Audit also evaluated any associated confidential informant 
packages and search warrants.' Finally, the Audit evaluated ATIS’ handling of initial leads. Per 
ATIS’ Standards and Procedures, at least annually, the Police Commission must audit ATIS’? 
operations. Due to limited resources, this Audit had not taken place for several years, but 
through the assistance of the Inspector General and his staff, the Police Commission was able to 
conduct the Audit. 


The Phase II portion of the Audit, expected to be completed by the summer of 2007, will include 
an assessment of all materials gathered, developed, or maintained by ATIS for intelligence 
purposes. Additionally, oral interviews of ATIS personnel will be conducted to ensure personnel 
are adhering to the Standards and Procedures that were approved by the Police Commission. 


Given ATIS deals with highly sensitive information, any reference to specific details of an 
investigation or ATIS operations were removed from the public version of this Audit Report. 


BACKGROUND 


The LAPD’s mission is to serve and protect the citizens of Los Angeles. Along that vein, the 
ATIS is charged with preventing and investigating terrorist activity and illegal actions that could 
result in a significant disruption of public order. Generally, the focus of ATIS is strategy 
oriented. The section focuses on determining the ultimate goal of individuals and/or groups, 
rather than on specific violations of the law. The objective is not to arrest and prosecute 
suspects, but rather to detect, collect, analyze and disseminate information for the purpose of 
developing intelligence and preventing future terrorist activity. The possibility of future terrorist 
attacks is an unfortunate reality that law enforcement throughout the United States must attempt 
to address. Certain individuals and/or groups may attempt to further their own societal 
objectives by influencing and/or harassing on the basis of race, religion, national origin, or 
sexual orientation. Often, this is accomplished by individuals/organizations planning, financing, 
and/or aiding/abetting various criminal acts. ' 


That being said, the Police Commission also recognizes the delicate balance between providing 
effective terrorist prevention activity and protecting the rights of citizens. Constitutional and 
statutory rights guarantee every citizen the right to privacy, to express ideas and dissension, and 
to associate publicly and privately for any lawful purpose. As such, the Police Commission has 
established a policy that strictly prohibits the use of illegal or unauthorized methods of 


' All search warrants reported to have been served by ATIS were reviewed and no significant concerns related to the 
articulated reasonable suspicion were noted. 
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collecting, maintaining, or disseminating intelligence information. It is both unnecessary and 
wrong to maintain an intelligence file on any individual or organization unless the “reasonable 
suspicion” standard is met. Personnel are also prohibited from collecting, maintaining or 
disseminating information about an individual’s sexual, political, or religious activities; beliefs; 
or opinions, unless such information is material to an approved investigation. 


There are three types of investigations conducted by ATIS, as follows: 


e Initial Lead Assessment/Investigation. Almost daily, ATIS receives initial leads on 
potential terrorist activity. The lead information may be received from other law 
enforcement agencies, Department employees, or private citizens. An ATIS supervisor 
reviews each lead and at that time, a decision is made to investigate the lead, refer the lead to 
another entity for investigation, or classify the lead as “for information only.” If the lead is 
retained by ATIS for investigation, limited activity is performed to determine whether further 
investigation is warranted. As investigative leads from the public or other sources may be 
vague and not yet meet the “reasonable suspicion” standard, the investigator may access 
public and government records; interview the reporting person, potential subject, or 
witnesses; and/or monitor the potential subject. Initial lead investigations must be completed 
within 60 days from the date the lead was received. 


e Preliminary Intelligence Investigation. A preliminary intelligence investigation may be 
initiated when reasonable and articulable suspicion exists to believe that an 
individual/organization may be: 1) planning, threatening, attempting, performing, 
aiding/abetting, or financing unlawful acts; and, 2) the results of which are intended to 
further their objectives by influencing societal action or harassing on the basis of race, 
religion, national origin, or sexual orientation. However, unlike initial leads, reasonable 
suspicion already exists but the information still needs to be developed to the point of 
reliability. Reasonable suspicion is defined as an honest belief based on known articulable 
circumstances which would cause a reasonable and trained law enforcement officer to 
believe that some activity relating to a significant disruption of the public order may be 
occurring or has the potential to occur. Reliable information is defined as information that 
can be depended on to be trustworthy or worthy of confidence. The Commanding Officer of 
Major Crimes Division (MCD) must approve the opening of each preliminary intelligence 
investigation and the investigation shall not exceed 120 days. 


e Open Intelligence Investigation. An open intelligence investigation may be initiated when 
reasonable and articulable suspicion exists based upon reliable information that an individual 
or organization may be: 1) planning, threatening, attempting, performing, aiding/abetting, or 
financing unlawful acts; and, 2) the results of which are intended to further their societal 
objectives by influencing societal action or harassing on the basis of race, religion, national 
origin, or sexual orientation. The Commanding Officer of MCD must approve the opening 
of each open intelligence investigation and each year, the Commanding Officer reviews each 
investigation to ensure justification still exists for the case to remain open. 
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RESULTS OF THE AUDIT 





Initial Leads 


A random sample of initial leads, generated from January 2005 to June 2006, were identified and 
_ reviewed to determine whether the handling of these initial leads was appropriate.” 


Based on our review, all the leads were properly classified and adequate steps were taken to 
investigate the leads retained and investigated by ATIS. Additionally, the initial leads 
investigated by ATIS were closed or converted into a preliminary or open intelligence 
investigation within the 60-day requirement. However, in our review of initial lead forms, it 
became apparent that greater care is needed with their completion. For example, on one form, 
there were inconsistencies with the marked check boxes on the form (the source reliability check 
box indicated “Fairly Reliable” and “Reliability Can’t Be Judged,” but the “Substantiated” check 
box was also marked). 


Additionally, it appears that internal controls surrounding the initial lead classification process 
could be enhanced. When ATIS decides to retain and investigate a lead, a supervisor completes 
an Investigative Follow-Up Checklist. This checklist documents the supervisor’s recommended 
investigative steps an assigned investigator should perform, and when the investigation is closed, 
the supervisor approves the closure on this checklist. However, the name of the supervisor is 
only typed in, making it impossible to verify that the supervisor actually approved the closure. 
Currently, initial leads are handled in a paperless fashion and all leads are handled electronically; 
however, we believe efforts should be made to ensure supervisor signatures are obtained. 
Additionally, one of the 14 lead investigations conducted by ATIS was closed without any 
indication of the approving supervisor. The date closed was also left blank. Per the 
Commanding Officer of MCD (ATIS is part of MCD), he recently issued a directive requiring 
the signature of an ATIS supervisor to close out all initial leads. 


3 


Preliminary Intelligence Investigations 


This Audit assessed each investigation and any associated working files that were investigated 
from January 2005 through June 2006.* Based on our assessment, ATIS is adhering to the 
120-day requirement to complete preliminary investigations. Although the Audit identified five 
investigations that were closed after the 120-day limitation (by an average of 10 days), based on 
the dates documented in the investigations, the delay was due to the Commanding Officer of 
MCD being unable to give his final approval for the closure, not the investigators failing to 
adhere to the Department’s Standards and Procedures. 


2 The initial leads were either referred to another entity, classified as information only, or investigated by ATIS. 
3 Lead sheets that document the referrals to other law enforcement agencies and information classified as “for 
information only” also do not contain signatures of approving supervisors (the form only contains a supervisor’s 
type name). . 

f A working file contains information material to an investigation. The investigative file contains intelligence 
reports completed by ATIS staff that are approved by the Commanding Officer of MCD. 
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Additionally, the Audit included an assessment of the reasonable suspicion used to open the 
preliminary intelligence investigations. Although the information used to support reasonable 
suspicion may not yet be reliable, reasonable suspicion must exist to open a preliminary 
intelligence investigation. Based on this assessment, the reasonable suspicion to open two 
investigations appeared questionable. These concerns were discussed with the Commanding 
Officer of MCD and he indicated that reasonable suspicion was based on the investigators’ 
training, experience, and knowledge about the subject, and information provided by another law 
enforcement agency. However, he agreed that more articulation regarding the reasonable 
suspicion should have been documented in the request to open the preliminary intelligence 
investigations. The Phase II portion of the Audit will follow-up on these two investigations and 
include a discussion with the investigators regarding the additional reasonable suspicion that was 
not originally articulated in the files. 


Finally, it was noted that three preliminary intelligence investigations were opened based on 
information provided by another law enforcement entity. This law enforcement agency provided 
information on many potential terrorist suspects. However, the justification to open these 
particular investigations just referred to the initial lead and did not document the reasonable 
suspicion. This concern was discussed with the Commanding Officer of MCD and he indicated 
that at the time of his approval to open the investigations, he was aware of the information 
provided by the law enforcement agency. He further indicated that these details, that provide 
additional support for ATIS’ reasonable suspicion, would be added to the investigations. The 
Phase II portion of the Audit will assess the information added to these investigations. 


Open Intelligence Investigations 


The Audit evaluated all open investigations, from January 2005 through June 2006, and focused 
on evaluating: 1) the reasonableness of keeping the investigations open; 2) the support for the 
reasonable suspicion; 3) the materiality of information maintained in associated working files for 
the investigations; and, 4) whether all material documents were included in the investigative and 
working files. 


Reasonableness of the Open Investigations: All available information contained in the open 
investigative and working files was evaluated to determine whether the investigations should 
remain open. Based on this review, it appeared that two investigations should be closed due to 
the lack of any recent/additional evidence. Specifically, for one investigation, the reasonable 
suspicion used to open the investigation appeared supported, but given the lack of any 
recent/additional evidence, it appeared that the investigation should be closed. In fact, the last 
intelligence report, dated over a year and a half ago, justified keeping the investigation open due 
to the subject using “counter surveillance techniques” (no further description provided) in a prior 
surveillance conducted over a year before and the investigator still wanted to determine the 
subject’s whereabouts. For another investigation, the initial reasonable suspicion was supported 
but given the lack of recent/additional evidence, it appeared that the investigation should be 
closed.’ There had been no additional information related to this subject for over two years. 


5 This investigation was based on an initial lead, but the information to support the reasonable suspicion was not 
delineated in the working files. 
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These concems were discussed with the Commanding Officer of MCD and he indicated that the 
investigations had been closed (after our initial review) when he performed his annual review of 
open investigations. 


Support for Reasonable Suspicion: Four investigations (the subjects all knew each other) did 
not have enough information in the investigative or working files to support how the investigator 
obtained part of the information used to support the reasonable suspicion. The four 
investigations had the same intelligence report (copied and placed in each file) that indicated the 
four subjects were members of a radical group. However, the files do not document how the 
information was obtained to support that these individuals were actually members of the group. 
Therefore, the Audit was unable to determine how the information, used to support the 
reasonable suspicion, was obtained. This concern was discussed with the Commanding Officer 
of MCD and he indicated the information was obtained through another law enforcement agency 
but agreed that there needed to be some articulable statement indicating where this information 
came from. 


Documented Materiality: All evidence gathered and retained in the investigative and working 
files was evaluated and for the most part, the information contained in the files appeared 
material. However, in five investigations, the Audit identified one or more documents in the 
working files in which it could not be determined whether the information was material to the 
investigation and there was no notation to indicate how the information was obtained or how the 
documents were material. The working files for three investigations contained photographs of 
individuals, vehicles, and/or residences/businesses; but the dates the photographs were taken 
and/or their materiality were not evident through a review of the file. Additionally, the working 
files for two investigations contained other documents that did not indicate how the information 
was obtained and/or their materiality. 


In the past, ATIS personnel used a stamp, wherein personnel documented how and when the 
information (placed in the working folder) was obtained and material to the investigation. The 
stamp was not present on a majority of documents contained in the working files for the 
investigations reviewed. The current Standards and Procedures are unclear as to whether 
investigators need to document the materiality determination and how and when the information 
was obtained. The OIG believes the better practice would be to document this type of 
information and it is suggested that the Standards and Procedures be updated to clarify this area. 
On a positive note, the Commanding Officer of MCD reinstated this procedure in a directive 
provided to all ATIS personnel in April 2006. 


Documentation: Investigative files contain intelligence reports completed by investigators 
which serve to update ATIS management and document any progress with the investigations. 
The investigations’ associated working files contain all documentation to support material 
information referenced in the intelligence reports. For example, if an intelligence report 
indicates that an individual publicly posted “hate” messages and other incriminating information, 
the associated working folder should contain applicable copies of the public message. This 
ensures that the information in the intelligence reports is valid and supported. For the open 
investigations, the intelligence reports were evaluated along with any associated working files. 
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For 15 investigations, there was additional information that the OIG believes should have been 
maintained in the working files, as discussed below: 


e For five investigations (four individual investigations and one organizational investigation), 
there was a photocopied intelligence report placed in each file that indicated the subject of 
one investigation was overheard stating he/she wanted to harm another person. However, the 
investigative and working files did not indicate who overheard this statement and the 
chronology log had no additional details. Additionally, the investigative files did not indicate 
whether there were any investigative steps to ensure this person was not in any danger. This 
concern was discussed with the Commanding Officer of MCD and he agreed that the 
working folder should have contained this information and stated how it was obtained. He 
stated that in this instance, the potential victim was notified by another agency.° 


e For four investigations (the four subjects were related), the investigative file documented the 
number of people attending a radical group meeting along with information about what was 
discussed. However, it is unknown how this information was obtained and the working files 
did not provide any additional information. 


e For one investigation, the intelligence report indicated that the subject purchased a violent 
and racist game but there was no indication of how this information was obtained. 
Additionally, the investigation did not have a chronology log or a working folder. 


e For one investigation, the investigative file indicated that on two occasions the investigator 
either spoke with the subject or ran into him/her at a public event.’ However, there was no 
documentation on the details of these encounters, specifically what if any information was 
obtained. 


e For one investigation, the investigative file referred to information that the subject produced 
that linked him/her to the main organization, but there were no copies of these documents in 
the investigative file and there was no working folder. 


e For one investigation, the investigative file indicated that while serving a search warrant, the 
officers found a document with ingredients for explosives. However, it is unknown who saw 
this document and the return to the search warrant (that could help support that the document 
was seized) was not included in the file. Additionally, the initial lead information was not 
included in the investigative file. 


6 Additionally, for one of these investigations, part of the reasonable suspicion is based on a crime committed by the 
subject; but the associated report was not included in the investigative or working folder. 

7 The chronology log indicated the subject spoke at a public meeting and seemed to indicate that the investigator 
spoke with the subject about the organization. Another chronology log entry indicated that the investigator ran into 
the subject at a public event. 
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e For one investigation, the initial lead used to support reasonable suspicion was not included 
in the investigative file or working folder. 


e For one investigation (an organization), the investigative file indicated that the investigator 
attended/surveilled a radical group meeting and the file indicated that numerous flyers 
produced by the organization were recovered in the City of Los Angeles. However, the 
investigative file did not document how this information was obtained or copies of the flyers. 
There was no working folder for this investigation. 


These concerns were discussed with the Commanding Officer of MCD and he agreed that there 
should be more articulation as to how the-information was obtained. He further indicated no 
undercover operations took place to obtain the information and that the information was either 
obtained during a public event or that citizens reported the information to their local police 
stations. 


Overall, it appears that additional efforts should be taken to ensure that all information in 
intelligence reports is supported. Of the open intelligence investigations reviewed, ten (three 
individual and seven organizational investigations) did not have an associated working folder. 
This means there was no chronology log or other background information used to assist/support 
information in the main investigative file. Also, it appears that there needs to be a standard 
checklist, similar to the ones used for initial lead investigations, that requires the investigator to 
obtain relevant/applicable information for the subjects of the investigation. For example, a 
majority of the investigations did not contain the subject’s driver license photograph, Department 
of Motor Vehicle information, criminal history, or Federal Bureau of Investigation information. 
Finally, 16 investigations that were open at the time of our evaluation did not have updates 
within the last six months (eight individual files and eight organization files). The Commanding 
Officer of MCD issued several directives in April 2006 to help supplement/clarify information 
provided in the Standards and Procedures manual. One directive required investigators to update 
open investigations at least twice a year to document the progress on the case, which would 
cause an investigator and the ATIS chain of command to evaluate whether the case should 
remain open. This requirement is not part of the current Standards and Procedures, but given its 
importance, it should be added. 


Confidential Informant Packages 


The Audit evaluated all informant packages for confidential informants used during 2005 and 
2006. The review identified one informant package, which was deactivated on December 2005, 
with a concern regarding the authenticity of information in an update report. Specifically, the 
Exceptional Handling Report had the same verbiage as the Exceptional Handling Report 
(copying and pasting) from three years before. Additionally, one Exceptional Handling Report 
had a discrepancy on when it was approved. Finally, the Contact Forms did not consistently 
document the notification to a supervisor when meeting with the informant. 
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Standards and Procedures 


According to the Standards and Procedures approved by the Police Commission, the Audit is 
required to review all of ATIS’ regulations, rules and policies. Before commencing the Audit, 
this information was requested and ATIS provided the Standards and Procedures that have 
guided their operations throughout the years. The ATIS provided their Standards and Procedures 
dated March 18, 2003; October 16, 2001; December 10, 1996; and January 31, 1984. There 
have been slight revisions in all of these Standards and Procedures and as such, the Audit 
evaluated them to determine if there are any requirements that are now outdated or omitted from 
the current Standards and Procedures used by ATIS personnel. 


Based on a review of the Standards and Procedures, the Audit identified the following concerns: 


e Prior Standards and Procedures used to allow for extensions (for up to three months) of 
preliminary investigations by the Commanding Officer of MCD if justification was present. 
As preliminary investigations should be thorough, if 120 days is not enough time, the 
Commanding Officer of MCD should be able to exercise this discretion. The same is true for 
initial lead investigations. Therefore, it is suggested that the Standards and Procedures be 
updated to allow this type of flexibility. 


ə The Standards and Procedures used to require that, semi-annually, all ATIS personnel needed 
to be trained on intelligence policy and procedure and on Constitutional and statutory 
considerations by the Commanding Officer of MCD and the Deputy City Attorney. As 
anti-terrorism case law is constantly being updated, this type of training appears necessary. 
Therefore, it is suggested that the Standards and Procedures be updated to allow this type of 
training on an annual basis. 


OTHER RELATED MATERS 





While conducting the Audit, certain concerns came to the auditors’ attention that did not 
necessarily fit into the Audit’s original scope. Specifically, it was noted that the Standards and 
Procedures require the Commanding Officer of MCD to provide, annually, written certification 
to the Police Commission that all current intelligence investigations were internally reviewed and 
those investigations considered no longer viable were closed. While ATIS has been completing 
this type of assessment, there is no evidence that the certification was sent to the Police 
Commission. In the future, it is suggested that the Commanding Officer of MCD provide this 
certification to the Police Commission annually. Additionally, in the past, ATIS personnel 
submitted to a lie detector examination prior to being placed in the section. Due to limited 
resources within the Department and a need to transfer personnel into the section in a relatively 
short timeframe, this process was eliminated from the selection process. However, given the 
section deals with highly sensitive information, it is a good protocol. The Commanding Officer 
of MCD indicated that he was delayed in re-implementing the protocol due to employment and 
legal considerations, but for new personnel transferred to ATIS, the lie detector examination has 
now been added back to the selection process. 
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As indicated earlier, ATIS’ objective is not to arrest and prosecute suspects, but rather to detect, 
collect, analyze and disseminate information for the purpose of developing intelligence and 
preventing future terrorist activity. However, when ATIS discovers possible criminal activity 
during an investigation, a referral is made to Major Crimes Division, Criminal Investigation 
Section, to investigate the criminal aspect of the case. As there could be a risk that terrorist 
investigations are being referred to the Criminal Investigation Section to circumvent the ATIS 
Standards and Procedure requirements, this Audit reviewed the criminal investigations referred 
by ATIS to the Criminal Investigation Section from 2003 through 2006. The Audit evaluated 
whether the referrals were appropriate and whether there was a legal basis for conducting the 
criminal investigations. Based on our review, no concerns were identified. 


CONCLUSION 





Overall, ATIS has done a good job adhering to the Standards and Procedures approved by the 
Police Commission. While the Audit identified a few areas where changes are needed, focused 
oversight should properly address these concerns going forward. 


